Enter your mobile number or email address below and we'll send you a link to download the free Kindle Reading App. Then you can start reading Kindle books on your smartphone, tablet, or computer - no Kindle device required.

Comment: This is a used text in good condition. It may have some writing and highlighting. Ships directly from Amazon. All Supplemental discs, materials, or access codes should be included. Eligible for free super saver shipping.

Fulfillment by Amazon (FBA) is a service we offer sellers that lets them store their products in Amazon's fulfillment centers, and we directly pack, ship, and provide customer service for these products. Something we hope you'll especially enjoy: FBA items qualify for FREE Shipping and .

It's easy to capture packets with Wireshark, the world's most popular network sniffer, whether off the wire or from the air. But how do you use those packets to understand what's happening on your network?

With an expanded discussion of network protocols and 45 completely new scenarios, this extensively revised second edition of the best-selling Practical Packet Analysis will teach you how to make sense of your PCAP data. You'll find new sections on troubleshooting slow networks and packet analysis for security to help you better understand how modern exploits and malware behave at the packet level. Add to this a thorough introduction to the TCP/IP network stack and you're on your way to packet analysis proficiency.

Learn how to:

Use packet analysis to identify and resolve common network problems like loss of connectivity, DNS issues, sluggish speeds, and malware infections

{"currencyCode":"USD","itemData":[{"priceBreaksMAP":null,"buyingPrice":34.26,"ASIN":"1593272669","isPreorder":0},{"priceBreaksMAP":null,"buyingPrice":35.23,"ASIN":"1593275099","isPreorder":0},{"priceBreaksMAP":null,"buyingPrice":9,"ASIN":"1494295504","isPreorder":0}],"shippingId":"1593272669::5d0lpELyBKrAjs4%2FWuHrKv8Ra3BzrcXvrPFSbfDfqETLX7t5zCH0Wq3s3628tI6YuI94tOWNYpM3YmLCJkUUDeYUylBRhjLr3HoslqJRZxPEY5UkDUWEuA%3D%3D,1593275099::Tej25v6IAa8vf6IcPqdpicJtPmFSJ40PUUfFzTpNEcwCsFrY1cdCHQ3vefu2e1x66h3RtcKvzI9%2Fm2Fo7VLPqEr2o%2BJcAL%2FpiscmcsorCBc8u%2F%2Bap10cCw%3D%3D,1494295504::%2Fy2WogrYrM%2Bi6l%2FIDzWC%2FLUAcRhC7KcGS5oGuRVy0e53aeaASq366ASmAbNgrS0lmDeiMTuwULOJqAcz%2FPMOPMR5HE4Kq49SeqhPQyw0lm0Y2MH78fu7VA%3D%3D","sprites":{"addToWishlist":["wl_one","wl_two","wl_three"],"addToCart":["s_addToCart","s_addBothToCart","s_add3ToCart"],"preorder":["s_preorderThis","s_preorderBoth","s_preorderAll3"]},"shippingDetails":{"xz":"same","xy":"same","yz":"same","xyz":"same"},"tags":["x","y","z","w"],"strings":{"addToWishlist":["Add to Wish List","Add both to Wish List","Add all three to Wish List","Add all four to Wish List"],"addToCart":["Add to Cart","Add both to Cart","Add all three to Cart","Add all four to Cart"],"showDetailsDefault":"Show availability and shipping details","shippingError":"An error occurred, please try again","hideDetailsDefault":"Hide availability and shipping details","priceLabel":["Price:","Price for both:","Price for all three:","Price For All Four:"],"preorder":["Pre-order this item","Pre-order both items","Pre-order all three items","Pre-order all four items"]}}

Editorial Reviews

Review

"An essential book if you are responsible for network administration on any level."

- Linux Pro Magazine

"A wonderful, simple to use and well laid out guide."

- Arsgeek.com

"If you need to get the basics of packet analysis down pat, this is a very good place to start."

- Stateofsecurity.com

About the Author

Chris Sanders is an information security consultant, author, and researcher originally from Mayfield, Kentucky. That's thirty miles southwest of a little town called Possum Trot, forty miles southeast of a hole in the wall named Monkey's Eyebrow, and just north of a bend in the road that really is named Podunk.

Chris is a Senior Security Analyst with InGuardians. He has as extensive experience supporting multiple government and military agencies, as well as several Fortune 500 companies. In multiple roles with the US Department of Defense, Chris significantly helped to further to role of the Computer Network Defense Service Provider (CNDSP) model, and helped to create several NSM and intelligence tools currently being used to defend the interests of the nation.

Chris has authored several books and articles, including the international best seller "Practical Packet Analysis" form No Starch Press, currently in its second edition. Chris currently holds several industry certifications, including the SANS GSE and CISSP distinctions.

In 2008, Chris founded the Rural Technology Fund. The RTF is a 501(c)(3) non-profit organization designed to provide scholarship opportunities to students form rural areas pursuing careers in computer technology. The organization also promotes technology advocacy in rural areas through various support programs. The RTF has provided thousands of dollars in scholarships and support to rural students.

When Chris isn't buried knee-deep in packets, he enjoys watching University of Kentucky Wildcat basketball, being a BBQ Pitmaster, amateur drone building, and spending time at the beach. Chris currently resides in Charleston, South Carolina with his wife Ellen.

Chris blogs at appliednsm.com and chrissanders.org. He is on Twitter as @chrissanders88.

Most Helpful Customer Reviews

First of all if you consider yourself an expert in packet analysis don't read this book to learn advanced techniques in packet analysis. Instead read this book as a teaching tool to help better explain packet analysis to others. I found myself reading this book and going "hey I wish someone would have explained it to me that way when I started" and "why didn't I explain it that way."This book is written for people who have little to no experience with packet analysis. It is also a good read for those who might have been out of the packet analysis game for a little while and need a quick read to brush up the skill-set. The book is well written and Sanders does an excellent job explaining things in a manner that is well understood. He eases the reader into explanations by going from layman to more technical jargon. The examples in the book match the title, they are practical and likely to be experienced in the real world. I would highly recommend this book to those who have little to no experience with packet analysis and are looking for a solid book to help them understand what many of the other books tend to explain in a lofty manner.

Firstly, this is mostly a book about using the Wireshark protocol analyzer tool and secondly a book about packet analysis (in the sense that it does not have space to cover in detail all the sorts of protocol problems someone is likely to encounter). Nevertheless, it's a good book and I'd recommend it to anyone who's beginner to middling with Wireshark. It does a good job of explaining the use of Wireshark and in particular the various configuration options.

There are odd faults (for example, there's a diagram showing a Cisco router, except it's not). There are also some colloquialisms (such as when the author says "Why have chicken when you can have steak?"). And I was disappointed that IPv6 wasn't really covered at all.

If you're experienced with packet analysis and want to learn Wireshark, this book is good for you. If you're a beginner at packet analysis this book is also good.

If you have done any type of performance testing, you've inevitably come across an application or two that could not be scripted using standard protocols in a performance test tool like LoadRunner. The Loadrunner protocol of last resort -- when no other protocol will work -- is called Winsock, and it can be pretty nasty to debug. That's the main reason I picked up this book.

Wireshark is a free, open-source tool that allows you to capture and analyze network traffic. With the communication captured, you can then easily tell it to filter on certain protocols, making reading the packet info much easier than it is in LoadRunner.

This book starts at ground level, assuming no user experience with packet analysis and/or packet sniffers. It can basically be divided into four sections.

The first covers packet analysis and network basics, and gives a nice overview of the OSI model. The second covers Wireshark's basic and advance features. The next covers common protocols like ARP, TCP and HTTP, and in the last section, the author ties it all together with real world examples using familiar sites like, Facebook and ESPN, while explaining how to troubleshoot common network issues.

I like the hands-on approach the writer uses throughout the book. He clearly explains everything in a clear, concise manner. I also appreciated the fact that the author uses packet capture files in each example that can be downloaded and opened in Wireshark in order to follow along. I was able to follow all of the examples without any confusion -- which is kind of a big deal, since packet analysis at this level is a new subject for me. Well done!

The book starts out with some requisite background knowledge about networking needed to understand the packets that will be analyzed. This will not make you a networking expert, but it is very informative for the newcomer and a great refresher for the oldies. After learning about the basics of networking and comparing layer 1, 2, and 3 devices, the book explains techniques for successfully sniffing traffic. The author does not steer clear of the valuable (but sometimes controversial) ARP Cache Poisoning and flood attacks that frequently work for sniffing through a switch.

The author also compares WIreshark (the selected sniffing tool) to some of the others, and clearly explains why he made the choice to use Wireshark. Time is spent familiarizing the reader with using Wireshark, covering installation and usage. The author also discusses how to write filters for capturing and displaying, which is essential to properly use the tool to wade through all the clutter. Finally, the packets that are typically found on a network are discussed and analyzed. The author points out many useful things that can be discovered by zeroing in on things like client/server latency (at different points throughout the TCP handshake) DNS abnormalities, and strange packets.

Also Security implications and intrusion detection are discussed, which I found to be extremely informative for the typical network administrator. FInally some real world scenarios are presented, at which point we examine real life packets to determine the cause of the network problems. This exercise was very helpful to tie in the previous knowledge with a practical hands on approach. Also much appreciated were the example packets.Read more ›

More About the Author

Chris Sanders is an information security consultant, author, and researcher originally from Mayfield, Kentucky. That's thirty miles southwest of a little town called Possum Trot, forty miles southeast of a hole in the wall named Monkey's Eyebrow, and just north of a bend in the road that really is named Podunk.

Chris Sanders is the Threat Intel Operations Lead at Mandiant, a division of FireEye, where he leads a small group tasked with effectively using network threat intelligence to catch adversaries. He has as extensive experience supporting multiple government and military agencies, as well as several Fortune 500 companies. In multiple roles with the US Department of Defense, Chris significantly helped to further to role of the Computer Network Defense Service Provider (CNDSP) model, and helped to create several NSM and intelligence tools currently being used to defend the interests of the nation.

Chris has authored several books and articles, including the international best seller "Practical Packet Analysis" form No Starch Press, currently in its second edition, and "Applied Network Security Monitoring" from Syngress. Chris currently holds several industry certifications, including the SANS GSE and CISSP distinctions.

In 2008, Chris founded the Rural Technology Fund. The RTF is a 501(c)(3) non-profit organization designed to provide scholarship opportunities to students form rural areas pursuing careers in computer technology. The organization also promotes technology advocacy in rural areas through various support programs. The RTF has provided thousands of dollars in scholarships and support to rural students.

When Chris isn't buried knee-deep in packets, he enjoys watching University of Kentucky Wildcat basketball, being a BBQ Pitmaster, amateur drone building, and spending time at the beach. Chris currently resides in Charleston, South Carolina with his wife Ellen.

Chris blogs at http://www.appliednsm.com and http://www.chrissanders.org. He is on Twitter as @chrissanders88.